597955f9905c34b066ca61a747e1642afd8ffd099a96565f59c7c1d574e79945

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
myfiles-setup-0.2.3-amd64.exe
Size 4.7MB
Sample261113-ff2jlsgs5k
SHA256 597955f9905c34b066ca61a747e1642afd8ffd099a96565f59c7c1d574e79945
MD5 6e7c49a8da319280cfe8d115e08b33db
SHA1 ace3d83475144b61e6bab58d42bca59349c0661f
SHA512 2a1c86ac06e1bda5ca598dcecd37a3a82f326e1ee5041e5cdfcdc0a03f26ec71321afad0adfcba4a90b0e346df9b063eeb30a7fd7969782d866da8ea048ee7a7
SSDEEP 98304:I4S4RsmfbSGD+JD1n85eUMCV+vY+iugwRNzJUgU:I4TOTD1UeUMCV+HgwRNzJUgU
TLSH
T18F363304F04A80FFDC6466F26E6A57BD226094B72EB84FF992CD35792D106029E3F4B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1472	MyFiles.exe

Loads dropped DLL 3 IoCs

pid	Process
3128	myfiles-setup-0.2.3-amd64.exe
3128	myfiles-setup-0.2.3-amd64.exe
3128	myfiles-setup-0.2.3-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2772	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	MyFiles.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	MyFiles.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MyFiles.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MyFiles.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	myfiles-setup-0.2.3-amd64.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	MyFiles.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	MyFiles.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	MyFiles.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	MyFiles.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	MyFiles.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	MyFiles.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	MyFiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	MyFiles.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	MyFiles.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2772	powershell.exe
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeIncreaseQuotaPrivilege	2772	powershell.exe
Token: SeSecurityPrivilege	2772	powershell.exe
Token: SeTakeOwnershipPrivilege	2772	powershell.exe
Token: SeLoadDriverPrivilege	2772	powershell.exe
Token: SeSystemProfilePrivilege	2772	powershell.exe
Token: SeSystemtimePrivilege	2772	powershell.exe
Token: SeProfSingleProcessPrivilege	2772	powershell.exe
Token: SeIncBasePriorityPrivilege	2772	powershell.exe
Token: SeCreatePagefilePrivilege	2772	powershell.exe
Token: SeBackupPrivilege	2772	powershell.exe
Token: SeRestorePrivilege	2772	powershell.exe
Token: SeShutdownPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeSystemEnvironmentPrivilege	2772	powershell.exe
Token: SeRemoteShutdownPrivilege	2772	powershell.exe
Token: SeUndockPrivilege	2772	powershell.exe
Token: SeManageVolumePrivilege	2772	powershell.exe
Token: 33	2772	powershell.exe
Token: 34	2772	powershell.exe
Token: 35	2772	powershell.exe
Token: 36	2772	powershell.exe
Token: SeIncreaseQuotaPrivilege	2772	powershell.exe
Token: SeSecurityPrivilege	2772	powershell.exe
Token: SeTakeOwnershipPrivilege	2772	powershell.exe
Token: SeLoadDriverPrivilege	2772	powershell.exe
Token: SeSystemProfilePrivilege	2772	powershell.exe
Token: SeSystemtimePrivilege	2772	powershell.exe
Token: SeProfSingleProcessPrivilege	2772	powershell.exe
Token: SeIncBasePriorityPrivilege	2772	powershell.exe
Token: SeCreatePagefilePrivilege	2772	powershell.exe
Token: SeBackupPrivilege	2772	powershell.exe
Token: SeRestorePrivilege	2772	powershell.exe
Token: SeShutdownPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeSystemEnvironmentPrivilege	2772	powershell.exe
Token: SeRemoteShutdownPrivilege	2772	powershell.exe
Token: SeUndockPrivilege	2772	powershell.exe
Token: SeManageVolumePrivilege	2772	powershell.exe
Token: 33	2772	powershell.exe
Token: 34	2772	powershell.exe
Token: 35	2772	powershell.exe
Token: 36	2772	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1472	MyFiles.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1472	MyFiles.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 2772	3128	myfiles-setup-0.2.3-amd64.exe	89
PID 3128 wrote to memory of 1472	3128	myfiles-setup-0.2.3-amd64.exe	92

C:\Users\Admin\AppData\Local\Temp\myfiles-setup-0.2.3-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\myfiles-setup-0.2.3-amd64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "& ([scriptblock]::Create([IO.File]::ReadAllText($env:MYGO_APP_SCRIPT)))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Users\Admin\AppData\Local\Programs\MyFiles\MyFiles.exe
  "C:\Users\Admin\AppData\Local\Programs\MyFiles\MyFiles.exe"
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.mygo-files

Path C:\Users\Admin\AppData\Local\Programs\MyFiles\.mygo-files
Size 12B
SHA256 6ec546c102acba4b8adaf3fff852314eeb34638a284b67a59a3ca593d6c00d43
MD5 14236bd490361ca8a53425f25a1209b9
SHA1 efb6417f2e06dfe8b28cd97e12b7ef5b4eeda475
SHA512 92f964d287981cf6b2b4f19dd792265c8e739ca9e6039c4ba513e8b0bb7f577ad1bb929c25e16fa7c25ee81ec36b50eabd2d7bf714c774cfd8e39fe676782e04
MD5 SHA1 SHA512

Submit Download

MyFiles.exe

Path C:\Users\Admin\AppData\Local\Programs\MyFiles\MyFiles.exe
Size 14.4MB
SHA256 f01734a14d8c48adae8b68c19da7f0c68390453a02d55159c0e82030f685aca5
MD5 fe6ab075768243a956b6f8325fd7566a
SHA1 301433e5aff97dbc89aff85b61fb3fcc3d3602ca
SHA512 f86d739662f4c8e5f92dbdc5ade7a7c95cc3a1f0651f3cedbc526c8c0d9f266ee55bb6ed467fda20197c3de101be54c74c4f82d3b9fbd6222d178d6d632f83f3
SSDEEP 98304:JOqA3DDZrcXks3vXkM8zKOj92SfFQtEN9AQV4DmA9bc4FvMfP1tzwvES:HOH9cUsvFhlETjV4D1I4FvMn1tzws
TLSH
T181E65A47ECA901E8C0EDD131C5A66113BB717C494B6163D71BA4F6286F77BC0AEBA318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MyFiles.exe

Path C:\Users\Admin\AppData\Local\Programs\MyFiles\MyFiles.exe
Size 15.9MB
SHA256 1fcb77b53f74aa20c8c5f825ce306b2e5feabc80b3e55d5a3a6deaeb3fed2269
MD5 387fa8065c82cc9b834f8eef17a8c6e0
SHA1 1f6f2017be4f5a069ec2864521db2f51999b2d62
SHA512 95ca65c859a7669aaec7391e2a2a49f1695f7d1019dca2085ba080006d5bf0f5bed6328a7e8556f7f08b81551134f636142a4bca9a350908401fd9ba6f9f1493
SSDEEP 98304:8nTcFvJqh88FgA8s5kUel/+xyUy1V+lsx1igQxTmQDaBZjMY/CeTohE:eCRqO8FRryU61nQxTBDtY/CeTt
TLSH
T10AF64957E9A905E4C0AED271C5A751237B317C490B3467DB1BA0F6242FB3BD0AEBA314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cwtptiue.xfv.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cwtptiue.xfv.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa528.tmp\System.dll
Size 12KB
SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
MD5 564e01f2c6edfb8475573e1b809cb5eb
SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
TLSH
T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

close-app.ps1

Path C:\Users\Admin\AppData\Local\Temp\nsa528.tmp\close-app.ps1
Size 1KB
SHA256 46fe8dad86835a192b4bc1eff978c77596c6066487b6817cb55d0f47ccf0a762
MD5 0e597c8472fbc2b2d09cd6597b032713
SHA1 c0cc47397a9b660005dc3a96d39db8183c0bfd7f
SHA512 102f49b5f8797a0e6d39e92706b217c2b62d6e658ac1bc8dd3e4d7c0d04f22796e3ed842a6fc69f03822b0cd6c6d10a419a17beac430b7d421e1e53028be7827
TLSH
T12C21322B2F0C897D93E71F47B19A93135C8911BC06779D284CBEC4947E1442A94A5A7B
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa528.tmp\nsDialogs.dll
Size 9KB
SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
MD5 79c27de4d1c6d295fefaa70f608f1c67
SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
TLSH
T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa528.tmp\nsExec.dll
Size 7KB
SHA256 1dee37f6abb2dec9e767bd022d29386b6b295bbd55bf316d2649b8d298f89e9d
MD5 879b0aab93b11228a27d6b2e498b95be
SHA1 f5024d0d44c37443d7c17f1ff80fba301389ed42
SHA512 427ddc4c01be77dd28a376a78714f5004edbee2df6662500cf11d2f4309fdf9a126d7632a7afd0e28712e851eabf56d9d469eb2f3b6c645923d3476275d6eff6
SSDEEP 192:JZFon9Dar9s7hdD8oZc41Zf0NQZGdH6E:RonlarK3orqf0NQZGdH
TLSH
T1FFE1E93571C02DF3D08A4A717D26B92B83F89826277741708B771AD979E0AE7FD24742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

session.json.tmp

Path C:\Users\Admin\AppData\Roaming\MyFiles\session.json.tmp
Size 280B
SHA256 fd8437f8d545a4bdb793cbcecfb967ee061ec1403a7699cd08b418f16c1a4843
MD5 ac70a42c3cb5d94ff05ee7f60a79de63
SHA1 38165ae4c20d1b73ae9f3e707e8fbfeed36d7843
SHA512 76eb7376d7b280fc849beeb38bfe52a99fea725cd59ccd93371e792ab69f72e401aad2e2c0cb6c68fd6e9c2f8b38bbd0c286df35b962647ee31b7f0c4a85aa51
TLSH
T1A0D05224C8B04EAB40CA38781A398342A860D28348F83E143C0D404C9F0CC2E2A7D2E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1472-105-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-99-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-96-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-95-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-94-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-93-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-92-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-103-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-104-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-106-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-107-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/1472-108-0x00007FF7C5BA0000-0x00007FF7C8A68000-memory.dmp

Download

memory/2772-20-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-34-0x00000225576F9000-0x00000225576FF000-memory.dmp

Download

memory/2772-33-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-31-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-29-0x0000022571B00000-0x0000022571B2A000-memory.dmp

Download

memory/2772-30-0x0000022571B00000-0x0000022571B24000-memory.dmp

Download

memory/2772-28-0x00000225716A0000-0x00000225716AA000-memory.dmp

Download

memory/2772-91-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-26-0x0000022571680000-0x000002257169E000-memory.dmp

Download

memory/2772-27-0x00000225718F0000-0x00000225719A2000-memory.dmp

Download

memory/2772-23-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-22-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-21-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-19-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-17-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-16-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-15-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-14-0x00000225715E0000-0x0000022571602000-memory.dmp

Download

memory/2772-11-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/2772-10-0x00007FF866A6F000-0x00007FF866A70000-memory.dmp

Download